Mojolicious-Plugin-Statsd Mixed Fixed Injection Fix (CVE-2026-00000000)

Vulnerability Overview Vulnerability Name: Mixed Fixed Injection CVE ID: CVE-2026-00000000 Publication Date: 2026-05-21 21:53:21+01:00 Europe/London Scope of Impact Affected Module: Mojolicious-Plugin-Statsd Affected Version: 0.06 Remediation Fixed Version: 0.06 Fix Details: Fixed the Mixed Fixed Injection vulnerability (CVE-2026-00000000) POC or Exploit Code No specific POC or exploit code is provided on the page. Additional Information New Features: - Use Net::Statsd::Tiny to handle the statsd protocol - Added client attribute to select any stats client Documentation Updates: - New maintainer: Robert Rothenberg - Updated copyright year - Added security policy - Added SECURITY CONSIDERATIONS section - Used Pod::Weaver - Added doap.xml metadata Incompatible Changes: - Minimum Perl version is v5.10 (same as current Mojolicious) Historical Version Changes 0.04 (2019-05-02T03:50:11): - Make 5.10 compatible - no package BLOCK until 5.14 0.03 (2019-04-29T04:05:47Z): - Initial changes - Added gauge and set_add methods 0.02 (2019-04-28T23:46:42Z): - Fix sample rate logging - Update POD - Send sample rate with metrics - Tidy up - Rename update_stats to counter to match other implementations - Rename add_prefix to counter to match other implementations - Remove configure method - Update docs, remove PodWeaver - Convert to dist - Rename Mojolicious - Only use add and check STATS_ADDER before default - Handle uninitialized (rejected) result from UDP to Mojolicious - Let's use warn instead of carp - Check if socket is already open - Avoid socket constant import - Remove adapter base class - Change default adapter to Statsd (localhost:8125) - Add missing Time::HiRes import for listing cuberef 0.01 (2019-04-26T06:53:03Z): - Simplify arg handling - Don't load adapter: Memory if not needed - Fix numbered list - Add license - Add readme - Use same arg style everywhere - Add adapter abstract docs - Further docs - Rename config to configure, don't store config anymore, make chainable - Synopsis works - Add plugin config, pass config thru to adapters - Test: Mojo not necessary here - Bundle metrics in same udp packet, test - Implement basic methods of stats plugin itself, add tests - Adapter should always expect name in arrayref; drop inc/decrement from interface - Set up statsd protocol the right way - Add adapter: Statsd - Initial commit Summary This page primarily introduces the fix for a Mixed Fixed Injection vulnerability (CVE-2026-00000000) in version 0.06 of the Mojolicious-Plugin-Statsd module. Additionally, it lists the new features, documentation updates, incompatible changes, and a detailed changelog for historical versions. No specific POC or exploit code is provided on the page.

Goal Reached Thanks to every supporter — we hit 100%!

Mojolicious-Plugin-Statsd Mixed Fixed Injection Fix (CVE-2026-00000000)